Smart Card based ssl connection not possible with SunPKCS11 Provider?

Question

Dear all
We use jsse connections with file based Pkcs12 Keystores for longer time.
Now we d'like to replace these .p12 files with SmartCards.
While the jsse 5 reference guide suggests:
"To use a Smartcard as a keystore or trust store, set the javax.net.ssl.keyStoreType and javax.net.ssl.trustStoreType system properties, respectively, to "pkcs11", and set the javax.net.ssl.keyStore and javax.net.ssl.trustStore system properties, respectively, to NONE. To specify the use of a specific provider, use the javax.net.ssl.keyStoreProvider and javax.net.ssl.trustStoreProvider system properties (e.g., "SunPKCS11-joe"). By using these properties, you can configure an application that previously depended on these properties to access a file-based keystore to use a Smartcard keystore with no changes to the application."
this does not work!
In the following Code sequence we get a
java.net.SocketException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID
System.setProperty("javax.net.ssl.trustStoreType", "pkcs11");
System.setProperty("javax.net.ssl.trustStore", "NONE");
System.setProperty("javax.net.ssl.trustStorePassword", pin);
System.setProperty("javax.net.ssl.trustStoreProvider", "SunPKCS11-ACOSTOKEN");
System.setProperty("javax.net.ssl.keyStoreType", "pkcs11");
System.setProperty("javax.net.ssl.keyStore", "NONE");
System.setProperty("javax.net.ssl.keyStorePassword", pin);
System.setProperty("javax.net.ssl.keyStoreProvider", "SunPKCS11-ACOSTOKEN");
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket)factory.createSocket(host, 443); // Exception here --> CKR_ATTRIBUTE_TYPE_INVALID
socket.startHandshake();
.Because the SmartCard with the KeyMaterial on it is working with
- IAIK package (JCE + PKCS11Wrapper + SSL)
- FireFox 2
I suggest we do something wrong here.
Has anyone an idea what it might be?
Thanks for yout help
Marcel

Answer 1

Hi all, I'm experiencing a problem using SunPKCS11 as a keystore provider for SSL.
String pkcs11config = "name = " + "bit4id" + "\nlibrary = " + "c:/windows/system32/bit4p11.dll";
byte[] pkcs11configBytes = pkcs11config.getBytes();
ByteArrayInputStream configStream = new ByteArrayInputStream(
pkcs11configBytes);
AuthProvider pkcs11Provider = new sun.security.pkcs11.SunPKCS11(
configStream);
pkcs11Provider.setCallbackHandler(new MyGuiCallbackHandler());
if (Security.getProvider(pkcs11Provider.getName()) != null) {
Security.removeProvider(pkcs11Provider.getName());
Security.insertProviderAt(pkcs11Provider, 2);
//Security.insertProviderAt(pkcs11Provider, 1);
System.setProperty("javax.net.ssl.keyStoreProvider",
pkcs11Provider.getName());
System.setProperty("javax.net.ssl.keyStoreType",
"PKCS11");
System.setProperty("javax.net.ssl.keyStore",
"NONE");
SSLContext sslcont = SSLContext.getInstance("SSL");
sslcont.init(null/*KM*/, tmS, rng);
If i use KM (KeyManager[] containing a KeyStore.getInstance("PKCS11")) everything works fine, but if I try to initialize the sslcontext using the default keyStoreProvider (just commenting out KM, and without any other modification to the code), it uses SUN instead of PKCS11, even if I set the system property javax.net.ssl.keyStore* (as you can see in my code)
Can anyone help me?
Masimaybe you an past the piece of code where you initialize things?
Thank's in advance and happy new year,
Patrizio